WO2021040303A1 - System for issuing plurality of certificates using extension functions, and method for issuing same - Google Patents

Abstract

A system for issuing certificates is characterized by comprising a first server which receives, from a user terminal, identification information of the user terminal, aG which is a value obtained by multiplying a random number a and a base point G on an elliptic curve equation, pG which is a value obtained by multiplying a random number p and the base point G on the elliptic curve equation, a first symmetric key, a second symmetric key, first index information, second index information, and an N value which is information about the number of certificates.

Description

System for issuing multiple certificates using extension functions and method for issuing the same

The present invention relates to a system for issuing a plurality of certificates using an extension function and a method for issuing the same.

In a general public key encryption method, a key pair is generated using an elliptic curve equation and used for the final public key generation. Here, the key pair means a random number and a value obtained by multiplying the random number by the base point, which is the coordinate of a point on the elliptic curve. In addition, the public key is included in a certificate issued by an accredited certification authority.

When a plurality of certificates is issued by generating a plurality of public keys, it may not be smooth in a limited communication environment. Therefore, for issuing multiple certificates, butterfly key extension is used. Butterfly key extension uses an extension function, and the element description of the extension function is a block encryption technique.

Korean Patent Publication No. 10-2018-0053066 discloses a method and system for issuing an implicit certificate applying a key expansion method. However, in the case of Korean Laid-Open Patent Publication No. 10-2018-0053066, since the certificate is issued between the host that is the certificate requester and the server of the upper certification authority that finally issues a plurality of certificates, the upper certification authority is the identification information of the certificate requestor. And the corresponding certificate information, it may represent a vulnerability in terms of personal information protection.

The present invention is an invention aimed at solving the technical problem as described above, without acquiring the identification information of the certificate requester from a higher level certification authority, and the information of the final private key is known only to the certificate requester, and personal information Its purpose is to provide a system for issuing multiple certificates and a method for issuing the same using an extension function that can enhance protection.

The certificate issuing system of the present invention includes a first server, wherein the first server includes identification information of the user terminal from the user terminal, aG, which is a value obtained by multiplying a random number a by a base point G on an elliptic curve equation, and a random number. pG, a value obtained by multiplying p by the base point G, a first symmetric key, a second symmetric key, first index information, second index information, and an N value, which is information on the number of certificates, is received, and the first symmetric key, the first symmetric key, and the second symmetric key A first extension function for inputting 1 index information, the second index information, and an N value, which is information on the number of the certificates; And the aG value; generating N 2-1 keys, and inputting the second symmetric key, the first index information, the second index information, and the N value, which is the number of certificates, as input. Second expansion function; And the pG value; by using, N number of 2-2 keys are generated.

Specifically, the first expansion function is calculated as a first first expansion function value by dividing the first first internal function value by the order value of the elliptic curve equation used in the first server, The first internal function value is a value obtained by adding 1 to 3 to the first symmetric key and the first first information value, respectively, by a first encryption function, and then adding 1 to 3 to the first first information value. It is a value obtained by connecting the X-OR operation result to a value and the result of the X-OR operation, and the first first information value is a value calculated using the first index information and the second index information. desirable.

In addition, the first expansion function is calculated as the w-th first expansion function value by dividing the w-th first internal function value by the order value of the elliptic curve equation, and the w-th first internal function value, After each of the values obtained by adding 1 to 3 to the w-th first information value calculated using the first symmetric key and the w-th first information value is encrypted by the first encryption function, the w-th first information This is the value obtained by adding 1 to 3 to the value and X-OR operation, and the result of X-OR operation is connected and output. Here, w is a natural number that is 2 or more and N or less.

In addition, the encryption by the first encryption function, (S100) using the S value, calculating the _{k-th round key (R k );} And (S200) generating an encrypted output using the corresponding k-th round key (R _k ) and T value calculated in step S100; including, wherein the S value is the first symmetric key, and the The T value is preferably a value obtained by adding one of the first information value to the N-th information value and one of 1 to 3.

Specifically, in the step S100, (S110) S _{is divided into 32-bit word units S b0} , S _b0+1 , S _b0+2 and S _b0+3 , and S _b0 , S _b0+1 , S _{b0 By} calculating +2 and S _b0+3 respectively and preset values F _b0 , F _b0+1 , F _b0+2 and F _b0+3 respectively, the initial four keys U _b0 , U _b0+1 , U _b0+2 And outputting _{U b0+3.} (S120) sequentially performing X-OR operations of _{U k+1} , U _k+2 and U _k+3 and the constant V _k; (S130) converting the result of step S120 by a nonlinear function; (S140) converting the result of step S130 by a linear function; And (S150) _{calculating U k+4} by performing an X-OR operation on the results of _{U k} and S140 steps; including, but increasing k from b0 to (b0+31) by 1, steps S120 to S150 Steps are repeatedly performed, and U _k+4 of step S150 is calculated as a corresponding k-th round key (R _k ), wherein b0 is a preset integer.

In addition, the step S200 may include (S210) dividing T into 32-bit word units T _d0 , T _d0+1 , T _d0+2 and T _d0+3 ; (S220) T _k+1 , T _k+2 and T _k+3 and the k-th round key (R _k ) being continuously X-ORed; (S230) converting the result of step S220 by a nonlinear function; (S240) converting the result of step S230 by a linear function; And (S250) _{calculating T k+4} by performing an X-OR operation on _{T k} and the result of the S240 step; including, and increasing k from d0 to (d0+31) by 1, from step S220 to Step S250 is repeatedly performed, and finally (T _d0+31+4 , T _d0+31+3 , T _d0+31+2 , T _d0+31+1 ) is output, but d0 is a preset integer. desirable.

In addition, each of the N number 2-1 keys is a value obtained by multiplying each of the first to the Nth first expansion function values by the base point G; and the aG value. In addition, each of the N 2-2 keys is a value obtained by multiplying each of the first to the N second expansion function values by the base point G; and the pG value.

In addition, the first server transmits the N keys 2-1 and the N keys 2-2 to the second server. In addition, the first server receives the encrypted N certificates and the random number c value from the second server, wherein each of the N certificates includes one final public key to be used in the user terminal. It is characterized. Preferably, the first server is characterized in that it transmits the encrypted N certificates and the random number c value to the user terminal.

In addition, the certificate issuing system of the present invention further includes the user terminal, wherein the user terminal calculates N inverse encryption function values using a random number p and the second expansion function, and calculates the N number of inverse encryption function values. By using the inverse encryption function value, the encrypted N certificates and the random number c value are inversely encrypted to calculate N final public keys and the random number c value. In addition, it is preferable that the user terminal calculates N final private keys using the random number a, the first expansion function, and the random number c.

In addition, the certificate issuing system of the present invention further includes the second server, wherein the second server adds the N 2-1 keys to a value obtained by multiplying the base point G by a random number c , N third keys are calculated, wherein the N third keys are N final public keys to be used in the user terminal. In addition, it is preferable that the second server encrypts the z-th third key and the random number c using the z-th 2-2 key, and z is a natural number of 1 or more and N or less.

In the method for issuing a certificate of the present invention, the first server includes identification information of the user terminal from the user terminal, a value aG obtained by multiplying a random number a by a base point G on an elliptic curve equation, and a value obtained by multiplying a random number p by the base point G. receiving a pG, a first symmetric key, a second symmetric key, first index information, second index information, and a value of N, which is information on the number of certificates; A first extension function in which the first server inputs the first symmetric key, the first index information, the second index information, and an N value, which is information on the number of certificates; And generating N 2-1 keys using the aG value; And a second extension function in which the first server inputs the second symmetric key, the first index information, the second index information, and an N value, which is information on the number of certificates. And generating N 2-2 keys using the pG value.

Specifically, the first expansion function is calculated as a first first expansion function value by dividing the first first internal function value by the order value of the elliptic curve equation used in the first server, The first internal function value is a value obtained by adding 1 to 3 to the first symmetric key and the first first information value, respectively, by a first encryption function, and then adding 1 to 3 to the first first information value. Each X-OR operation with a value, and a value obtained by connecting the result of the X-OR operation, and the first first information value is a value calculated using the first index information and the second index information. It is characterized. In addition, the first expansion function is calculated as the w-th first expansion function value by dividing the w-th first internal function value by the first symmetric key, and the w-th first internal function value is the first The values obtained by adding 1 to 3 to the w-th first information value calculated using the symmetric key and the w-1 th first information value are each encrypted by the first encryption function, and then 1 to the w-th first information value. A value obtained by adding to 3 is a value obtained by connecting the X-OR operation and the result of the X-OR operation to output, and w is preferably a natural number that is 2 or more and N or less.

In addition, the encryption by the first encryption function, (S100) using the S value, calculating the _{k-th round key (R k );} And (S200) generating an encrypted output using the corresponding k-th round key (R _k ) and T value calculated in step S100; including, wherein the S value is the first symmetric key value, and the The T value is a value obtained by adding one of the first to the Nth first information value and one of 1 to 3;

Specifically, in the step S100, (S110) S _{is divided into 32-bit word units S b0} , S _b0+1 , S _b0+2 and S _b0+3 , and S _b0 , S _b0+1 , S _{b0 By} calculating +2 and S _b0+3 respectively and preset values F _b0 , F _b0+1 , F _b0+2 and F _b0+3 respectively, the initial four keys U _b0 , U _b0+1 , U _b0+2 And outputting _{U b0+3.} (S120) sequentially performing X-OR operations of _{U k+1} , U _k+2 and U _k+3 and the constant V _k; (S130) converting the result of step S120 by a nonlinear function; (S140) converting the result of step S130 by a linear function; And (S150) _{calculating U k+4} by performing an X-OR operation on the results of _{U k} and S140 steps; including, but increasing k from b0 to (b0+31) by 1, steps S120 to S150 Steps are repeatedly performed, and U _k+4 of step S150 is calculated as a corresponding k-th round key (R _k ), but it is preferable that b0 is a preset integer.

In addition, the step S200 may include (S210) dividing T into 32-bit word units T _d0 , T _d0+1 , T _d0+2 and T _d0+3 ; (S220) T _k+1 , T _k+2 and T _k+3 and the k-th round key (R _k ) being continuously X-ORed; (S230) converting the result of step S220 by a nonlinear function; (S240) converting the result of step S230 by a linear function; And (S250) _{calculating T k+4} by performing an X-OR operation on _{T k} and the result of the S240 step; including, and increasing k from d0 to (d0+31) by 1, from step S220 to Step S250 is repeatedly performed, and finally (T _d0+31+4 , T _d0+31+3 , T _d0+31+2 , T _d0+31+1 ) is output, but d0 is a preset integer. It is characterized.

In addition, each of the N number 2-1 keys is a value obtained by multiplying each of the first to the Nth first expansion function values by the base point G; and the aG value. In addition, each of the N 2-2 keys is a value obtained by multiplying each of the first to the N second expansion function values by the base point G; and the pG value.

Preferably, the method of issuing a certificate of the present invention comprises the steps of: transmitting, by the first server, the N keys 2-1 and the N keys 2-2 to a second server; And receiving, by the first server, the encrypted N certificates and the random number c value from the second server, wherein each of the N certificates is one final public key to be used in the user terminal. It characterized in that it contains.

In addition, the method of issuing a certificate of the present invention comprises the steps of: transmitting, by the first server, N encrypted certificates and a random number c value to the user terminal; Calculating, by the user terminal, N inverse encryption function values using the random number p and the second expansion function; Calculating, by the user terminal, N final public keys and random number c values by inverse encryption of the N encrypted certificates and random number c values using the N inverse encryption function values; It characterized in that it further includes.

In addition, the method of issuing a certificate of the present invention may further include, by the user terminal, calculating N final private keys using a random number a, the first expansion function, and the random number c. .

In addition, the method of issuing a certificate of the present invention comprises the step of calculating, by the second server, the base point G multiplied by a random number c by adding the N number of keys 2-1 to each of the N number of keys. It further includes;, wherein the N third keys are N final public keys to be used in the user terminal.

Preferably, the method of issuing a certificate of the present invention further includes, by the second server, encrypting a z-th third key and the random number c using a z-th 2-2 key; Is preferably a natural number of 1 or more and N or less.

According to the system for issuing a plurality of certificates using the extension function of the present invention and the issuing method thereof, the upper certification authority does not acquire the identification information of the certificate requester, and the information of the final private key is known only to the certificate requester, and thus personal information Protection can be strengthened.

1 is a configuration diagram of a system for issuing a plurality of certificates using an extension function according to a preferred embodiment of the present invention.

Fig. 2 is a flowchart of an operation by a first encryption function.

3 is a detailed flowchart of step S100.

4 is a detailed flowchart of step S200.

Hereinafter, a system for issuing a plurality of certificates using an extension function according to an embodiment of the present invention and a method for issuing the same will be described in detail with reference to the accompanying drawings.

It goes without saying that the following examples of the present invention are for embodiing the present invention and do not limit or limit the scope of the present invention. What can be easily inferred by experts in the technical field to which the present invention pertains from the detailed description and examples of the present invention is interpreted as belonging to the scope of the present invention.

The system 100 for issuing a plurality of certificates using an extension function according to an embodiment of the present invention and a method for issuing the same use a butterfly key extension method.

First, FIG. 1 shows a configuration diagram of a system 100 for issuing a plurality of certificates using an extension function according to an embodiment of the present invention.

As can be seen from FIG. 1, a plurality of certificate issuing systems 100 using an extension function according to a preferred embodiment of the present invention include a user terminal 10, a first server 20, and a second server 30. ) Can be included.

The user terminal 10, the first server 20, and the second server 30, respectively, are computing devices having memory and communication functions.

Briefly explaining the operation of the system 100 for issuing a plurality of certificates using an extension function according to a preferred embodiment of the present invention, the second server 30 generates N final public keys, and the user terminal 10 By receiving N final public keys, the user terminal 10 generates N final private keys.

In the issuing process of these N final public keys and N final private keys, in order to enhance security for personal information, the first server 20 is interposed between the user terminal 10 and the second server 30. There is a feature of the present invention.

The user terminal 10 may be, for example, a personal terminal such as a smartphone or a computer, and a vehicle terminal installed inside the vehicle.

The user terminal 10 generates an arbitrary random number a in a range greater than 1 and smaller than the integer n, which can be referred to as the initial private key value for signature. In addition, the user terminal 10 generates a random number p in a range greater than 1, which is an initial private key value for data encryption, and smaller than an integer n.

The first server 20 uses aG that forms a pair with the random number a by multiplying the base point G as a coordinate of a point on the elliptic curve equation determined by the elliptic curve encryption algorithm for each of the random numbers a and p, A pair of pG is used with the random number p. For reference, since each of the random numbers a and p uses the same elliptic curve equation, its base point is also the same value.

Here, the random numbers a and p are private keys because they are used by the user terminal 10, and aG and pG are public keys because they are used by the first server 20. In addition, since the private key and the public key have different values, they correspond to an asymmetric key.

The information of the base point is information that the user terminal 10, the first server 20, and the second server 30 all know.

In addition, the user terminal 10 generates a first symmetric key and a second symmetric key.

The generated first symmetric key and second symmetric key are transmitted to the first server 20 and used to generate a plurality of final private keys and a plurality of final public keys for key expansion, and are random numbers. Each of the first symmetric key and the second symmetric key is transmitted to the first server 20 so that the user terminal 10 and the first server 20 use the same first symmetric key and the second symmetric key. Called.

In addition, the user terminal 10 generates first index information and second index information.

The first index information and the second index information represent information corresponding to indexes for a plurality of certificates requested by the user terminal 10, that is, index information, and the first certificate issued at 11:00 on March 8, 2019. , A second certificate, and the like. That is, the first index information and the second index information use information about the issuance time of the certificate. In this case, the first index information may correspond to the date and time of issuance information, and the second index information may correspond to information for indexing the order of certificates issued on the corresponding issue date and time, and a serial number. That is, the first index information is upper index information, and the second index information represents lower index information that indexes the first index information more specifically.

The user terminal 10 includes identification information of the user terminal 10, aG, pG, a first symmetric key, a second symmetric key, a first index information, a second index information, and an N value, which is information on the number of required certificates. Is transmitted to the first server 20.

The first server 20 includes identification information of the user terminal 10 from the user terminal 10, a value aG obtained by multiplying the random number a by the basis point G on the elliptic curve equation, the random number p and the basis point G on the elliptic curve equation. The multiplied by pG, the first symmetric key, the second symmetric key, the first index information, the second index information, and the N value, which is information on the number of certificates, are received.

Specifically, the first server 20 includes: a first extension function for inputting a first symmetric key, first index information, second index information, and an N value, which is information on the number of certificates; And aG value; to generate N 2-1 keys. In addition, the first server 20 includes: a second extension function for inputting a second symmetric key, first index information, second index information, and an N value, which is information on the number of certificates; And pG value; to generate N 2-2 keys.

The first expansion function f1(m) can be expressed as the following [Equation 1].

The meaning of the (A)mod(B) function in [Equation 1] is a modular operation function that calculates the remaining value obtained by dividing A by B as a result value. In addition, Y is the order value of the elliptic curve equation used by the user terminal 10 to generate a key pair of a and aG, and the same elliptic curve equation is also used in the first server 20. That is, Y is also the order value of the elliptic curve equation used in the first server 20. This order value is a constant value that can be easily obtained from the elliptic curve equation defined by the user terminal 10 and the first server 20. Also, f11(m) denotes a first internal function. Here, if m is set from 1 to N, N private keys by the N first expansion functions of the first first expansion function (f1(1)) to the Nth first expansion function (f1(N)) Can be created.

Specifically, the first internal function f11(m) can be expressed as the following [Equation 2].

In [Equation 2], Enc means a first encryption function. The first encryption function will be described later. here

Denotes an X-OR (exclusive OR) operation. In addition, || represents a linking function, and as an example, A||B||C represents one value in which A, B, and C values are sequentially connected. Also, ck means a first symmetric key.

As can be seen from [Equation 1] and [Equation 2], the first expansion function is the residual value obtained by dividing the first internal function value by the order value of the elliptic curve equation, and the first expansion function value It is calculated as. Here, the first first internal function value is a value obtained by adding 1 to 3 to the first symmetric key and the first first information value, respectively, encrypted by the first encryption function, and then 1 to 1 to the first first information value. It is the value obtained by adding 3 plus X-OR operation and concatenating the result of X-OR operation.

In addition, for the first expansion function, a residual value obtained by dividing the w-th first internal function value by the order value of the elliptic curve equation is calculated as the w-th first expansion function value. Here, the w-th first internal function value is obtained by adding 1 to 3 to the w-th first information value calculated using the first symmetric key and the w-1 first information value, respectively, by the first encryption function. After encryption, an X-OR operation is performed with a value obtained by adding 1 to 3 to the w-th first information value, and the result of the X-OR operation is concatenated to be an output value. In addition, w is characterized in that it is a natural number that is 2 or more and N or less.

In addition, o1(1) and o1(m) are first information values and can be expressed as the following [Equation 3] and [Equation 4].

For reference, o1(1) is an o1(m) value when m=1, and represents an initial value of o1(m). In addition, i and j denote first index information and second index information, respectively.

That is, o1(1) is defined by [Equation 3], and o1[2] to o1[N] are defined by [Equation 4]. In addition, 0 ³² represents a value of 32-bit 0.

The second expansion function f2(m) can be expressed as the following [Equation 5].

In [Equation 5], the meaning of the (A)mod(B) function is a modular operation function that calculates the remaining value obtained by dividing A by B as a result value. In addition, Y is the order value of the elliptic curve equation used by the user terminal 10 to generate a key pair of p and pG, and the same elliptic curve equation is also used in the first server 20. That is, Y is also the order value of the elliptic curve equation used in the first server 20. This value is the same as the Y value in [Equation 1]. Also, f21(m) denotes a second internal function. Here, if m is set from 1 to N, N number of public keys by the N second expansion functions of the first second expansion function (f2(1)) to the Nth second expansion function (f2(N)) Can be created.

Specifically, the second internal function f21(m) can be expressed as the following [Equation 6].

In [Equation 6], Enc means the first encryption function. The first encryption function will be described later. here

Denotes an X-OR (exclusive OR) operation. In addition, || represents a linking function, and as an example, A||B||C represents one value in which A, B, and C values are sequentially connected. Also, ek means a second symmetric key.

As can be seen from [Equation 5] and [Equation 6], the second expansion function is the residual value obtained by dividing the first second internal function value by the order value of the elliptic curve equation, and the first second expansion function value It is calculated as. Here, the first second internal function value is a value obtained by adding 1 to 3 to the second symmetric key and the first second information value, respectively, encrypted by the first encryption function, and then 1 to 1 to the first second information value. It is the value obtained by adding 3 plus X-OR operation and concatenating the result of X-OR operation.

In addition, for the second expansion function, a residual value obtained by dividing the w-th second internal function value by the second symmetric key is calculated as the w-th second expansion function value. Here, the w-th second internal function value is obtained by adding 1 to 3 to the w-th second information value calculated using the second symmetric key and the w-1 second information value, respectively, by the first encryption function. After encryption, the value obtained by adding 1 to 3 to the w-th second information value and each X-OR operation, and the result of the X-OR operation are concatenated and output. In addition, w is characterized in that it is a natural number that is 2 or more and N or less.

In addition, o2(1) and o2(m) are second information values, and may be expressed as the following [Equation 7] and [Equation 8].

For reference, o2(1) is an o2(m) value when m=1, and represents an initial value of o2(m). In addition, i and j denote first index information and second index information, respectively.

That is, o2(1) is defined by [Equation 7], and o2[2] to o2[N] are defined by [Equation 8]. In addition, 1 ³² represents a value of 32 bits 1, and 0 ³² represents a value of 32 bits 0.

The N number of 2-1 keys B2(m) generated by the first server 20 may be calculated as shown in [Equation 9] below.

As can be seen from [Equation 9], each of the N-th 2-1 keys is on an elliptic curve determined by the elliptic curve encryption algorithm in each of the first to the N-th first expansion function value. A value obtained by multiplying the base point, which is the coordinate of a point; and a value obtained by multiplying the random number a by the base point; can be expressed as a sum of.

The N number of 2-2 keys Q2(m) generated by the first server 20 may be calculated as shown in [Equation 10] below.

As can be seen from [Equation 10], each of the N-th 2-2 keys is on the elliptic curve determined by the elliptic curve encryption algorithm in each of the first second expansion function value to the N-th second expansion function value. It can be expressed as a value obtained by adding a value obtained by multiplying the base point, which is a coordinate of a point; and a value obtained by multiplying the base point by the random number p.

The first server 20 transmits the N 2-1 keys and the N 2-2 keys to the second server 30.

The second server 30 is a server of an upper level certification authority of the first server 20 and is a server that issues a certificate. The second server 30 generates N third keys D3(m) by the following [Equation 13].

As can be seen from [Equation 11], the second server 30 multiplies the base point, which is the coordinate of a point on the elliptic curve determined by the elliptic curve encryption algorithm, by the random number c. Each -1 key is added to calculate N third keys. The N third keys become N final public keys to be used in the user terminal 10.

That is, a new public key, a third key, is generated by the second server 30, and the user terminal ( 10) can be delivered. Therefore, the first server 20, which is a registration certification authority, cannot know the information of the finally issued public key of the user terminal 10, and the second server 30, which is a higher level certification authority, is a user transmitted by the first server 20. Since the correlation between the identification information of the terminal 10 and the third key, which is a new public key, is not known, the third key information, which is the final public key, is known, but what kind of identification information is the certificate corresponding to the user terminal 10? Becomes unknown. In other words, it is a system design that guarantees privacy.

In addition, the second server 30 encrypts the N third keys and the random number c by using the N 2-2 keys.

Specifically, the second server 30 encrypts the z-th third key and the random number c using the z-th 2-2 key. Here, z is a natural number that is 1 or more and N or less.

The second server 30 encrypts the certificate including the third key and the value c, and then transmits the encrypted certificate and the value c to the first server 20. That is, the second server 30 transmits the encrypted N certificates and the random number c value to the first server 20. Each of the N certificates includes one final public key to be used in the user terminal 10. That is, the N final public keys to be used in the user terminal 10 are transmitted from the second server 30 to the first server 20 by means of the N certificates.

In addition, the first server 20 transmits the encrypted N certificates and the random number c value transmitted from the second server 30 to the user terminal 10.

The user terminal 10 calculates the inverse encryption function value Q4(m) by the following [Equation 12].

As can be seen from [Equation 12], the user terminal 10 calculates N inverse encryption function values using a random number p and a second extension function.

The user terminal 10 uses the N inverse encryption function values to inverse encryption of the encrypted N certificates and the random number c value, so that the N final public keys (D3(m)) and the random number c value Can be calculated.

In addition, the user terminal 10 calculates N final private keys (B(m)) by the following [Equation 13].

As can be seen from [Equation 13], the user terminal 10 calculates N final private keys using a random number a, a first expansion function, and a random number c.

As shown in [Equation 12] and [Equation 13], the user terminal 10 receives the number of final public keys and final private keys requested by itself from the second server 30, which is a higher level certification authority, while ensuring privacy. Can be completed.

Here, since the N final private keys are keys used by the user terminal 10 itself, they are private keys, and the N final public keys are used by a device other than the user terminal 10, and thus become public keys. For example, when the user terminal 10 signs a document with a private key, another device that has received the document may decrypt the password using the public key paired with the corresponding private key.

In addition, as can be seen from [Equation 12] and [Equation 13], the user terminal 10 may also calculate a first extension function and a second extension function. The first and second extension functions calculated by the user terminal 10 represent the same functions as the first and second extension functions calculated by the first server 20, respectively.

Hereinafter, the first encryption function calculated by the first server 20 will be described in detail.

2 shows a flowchart of an operation by the first encryption function.

As can be seen from FIG. 2, encryption by the first encryption function includes: (S100) calculating a _{corresponding k-th round key (R k) using an S value;} And (S200) generating an encrypted output using the k-th round key (R _{k) and T value calculated in step S100.}

As can be seen from [Equation 2], when the first expansion function uses the first encryption function, the S value is the first symmetric key value, and the T value is the first first information value to the Nth first information value One of; and one of 1 to 3; is added together. Likewise, as can be seen from [Equation 6], when the second extension function uses the first encryption function, the S value is the second symmetric key value, and the T value is the first second information value to the N-th second One of the information values; and one of 1 to 3; are added to each other. That is, the S value and the T value are given as inputs.

3 is a detailed flowchart of step S100.

As can be seen from FIG. 3, in step S100, (S110) S _{is divided into 32-bit word units S b0} , S _b0+1 , S _b0+2 and S _b0+3 , and S _b0 , S _{b0 By} calculating +1, S _b0+2 and S _b0+3 respectively and preset values F _b0 , F _b0+1 , F _b0+2 and F _b0+3 respectively, the initial four keys U _b0 , U _b0+1 , Outputting _{U b0+2} and U _b0+3; (S120) sequentially performing X-OR operations of _{U k+1} , U _k+2 and U _k+3 and the constant V _k; (S130) converting the result of step S120 by a nonlinear function; (S140) converting the result of step S130 by a linear function; And (S150) _{calculating U k+4} by performing an X-OR operation on the results of _{U k and S140.} In step S100, steps S120 to S150 are repeatedly performed while k is increased by 1 from b0 to (b0+31) by steps S115, S160, and S170.

In addition, U _k+4 in step S150 is calculated as the k-th round key R _k. In addition, it is preferable that b0 is a preset integer. For example, b0 may be set to 0.

The initial four keys U _b0 , U _b0+1 , U _b0+2 and U _b0+3 in step S110 are respectively S _b0 , S _b0+1 , S _b0+2 and S _b0+3 respectively and preset values It is characterized in that it is calculated by an X-OR operation of _{F b0} , F _b0+1 , F _b0+2 and F _b0+3. The nonlinear function in step S130 may use, for example, a preset correspondence table. In addition, the linear function in step S140 may be a shift operation.

In step S100, after the conversion by the nonlinear function in step S130, the transformation by the linear function in step S140 can be performed, whereby stronger encryption performance can be exhibited.

4 is a detailed flowchart of step S200.

As can be seen from FIG. 4, step S200 includes (S210) dividing _{T into 32-bit word units T d0} , T _d0+1 , T _d0+2 and T _d0+3; (S220) T _k+1 , T _k+2 and T _k+3 and the k-th round key (R _k ) being continuously X-ORed; (S230) converting the result of step S220 by a nonlinear function; (S240) converting the result of step S230 by a linear function; And (S250) _{calculating T k+4} by performing an X-OR operation on the results of steps _{T k and S240.} In addition, step S200, while increasing k by 1 from d0 to (d0+31) by steps S215, S260, and S270, steps S220 to S250 are repeatedly performed, and finally (T _{d0+31+) 4} , T _d0+31+3 , T _d0+31+2 , T _d0+31+1 ) are output. d0 is a preset integer and may be set to 0, for example.

Similar to the step S100, the step S200 can exhibit stronger encryption performance by performing the transformation by the nonlinear function in the step S230 and then by the linear function in the step S240.

The nonlinear function in step S230 may use, for example, a preset correspondence table. In addition, the linear function of step S240 may be a shift operation.

Hereinafter, a method of issuing a certificate using an extension function according to a preferred embodiment of the present invention will be described.

The method of issuing a certificate using an extension function according to a preferred embodiment of the present invention uses the above-described certificate system using the extension function, so even if there is no separate description, it includes all the features of the certificate system using the extension function. to be.

A method of issuing a certificate using an extension function according to a preferred embodiment of the present invention includes (S11) the user terminal 10, the identification information of the user terminal, a value aG obtained by multiplying the random number a by the base point G on the elliptic curve equation, The value pG obtained by multiplying the random number p by the basis point G on the elliptic curve equation, the first symmetric key, the second symmetric key, the first index information, the second index information, and the N value, which is the number of certificates, is the first server 20 It includes; transmitting to).

In addition, the method for issuing an implicit certificate using an extension function according to a preferred embodiment of the present invention includes (S21) the first server 20, the identification information of the user terminal 10 from the user terminal 10, a random number a And a G multiplied by the basis point G on the elliptic curve equation, pG multiplied by the random number p and the basis point G on the elliptic curve equation, the first symmetric key, the second symmetric key, the first index information, the second index information, and the certificate Receiving an N value that is information on the number of; (S22) the first server 20, a first extension function for inputting a first symmetric key, first index information, second index information, and an N value, which is information on the number of certificates; And generating N 2-1 keys using aG value; (S23) a second extension function in which the first server 20 inputs a second symmetric key, first index information, second index information, and an N value, which is the number of certificates; And generating N 2-2 keys using a pG value; And (S24) transmitting, by the first server 20, the N keys 2-1 and the N keys 2-2 to the second server 30.

In addition, the method for issuing an implicit certificate using an extension function according to a preferred embodiment of the present invention includes (S31) the second server 30, N number of 2-1 keys and N number of keys from the first server 20. Receiving a 2-2 key; (S32) The second server 30 adds N 2-1 keys to a value obtained by multiplying the base point, which is the coordinate of a point on the elliptic curve determined by the elliptic curve encryption algorithm, by a random number c, Calculating a third key; (S33) encrypting, by the second server 30, the z-th third key and the random number c by using the z-th 2-2 key; And (S34) transmitting, by the second server 30, the encrypted N certificates and the random number c value to the first server 20.

Preferably, the method for issuing a plurality of certificates using an extension function according to a preferred embodiment of the present invention includes (S25) the first server 20, the encrypted N certificates and the random number c value as the second server ( Receiving from 30); And (S26) transmitting, by the first server 20, the encrypted N certificates and the random number c value to the user terminal 10.

In addition, a method for issuing a plurality of certificates using an extension function according to a preferred embodiment of the present invention includes (S12) the user terminal 10 receives encrypted N certificates and a random number c value from the first server 20 The step of doing; (S13) calculating, by the user terminal 10, N inverse encryption function values using a random number p and a second expansion function; (S14) The user terminal 10 calculates N final public keys and random number c values by inverse encryption of N encrypted certificates and random number c values using N inverse encryption function values. step; And (S15) calculating, by the user terminal 10, N final private keys using a random number a, a first expansion function, and a random number c.

Features of the multiple certificate issuing system 100 and the issuing method using the extension function of the present invention will be summarized below.

In the present invention, the second server 30, which is a higher level certification authority, which has received the keys of the N 2-1 keys and the N 2-2 keys, serves to issue a plurality of final public key certificates. The second server 30 is in a situation where it is impossible to discern which user terminal 10 has requested issuance of a certificate.

On the other hand, the first server 20 can know the identification information of the user terminal 10 requesting the certificate issuance, the first symmetric key and the second symmetric key using the first expansion function and the second expansion function. It is a situation in which important information on (10) is secured. Accordingly, since a security problem in the first server 20 may occur, the second server 30 multiplies the received N number of 2-1 keys by a random number c, and a third key that is a new public key By setting, security for the first server 20 is strengthened. That is, by setting the third key, which is a new public key, a new public key certificate different from the 2-2 key, which is the public key known to the first server 20, can be delivered to the user terminal 10. Therefore, the first server 20 is not able to know the public key information finally issued by the user terminal 10, and the second server 30 is the public key 2-2 transmitted by the first server 20. Since the correlation between the key and the identification number of the user terminal 10 is not known, it is not possible to know which certificate corresponds to the user terminal 10 even though the final public key information is known. In other words, the protection of personal information can be strengthened.

That is, according to the present invention, the following objects can be achieved.

(1) The user terminal 10 that first requested a plurality of public key certificates may receive a final plurality of public key certificates from the second server 30, which is a higher level certification authority.

(2) In addition, the user terminal 10 may calculate and secure a plurality of corresponding private keys from a plurality of public key certificates.

(3) In addition, only the user terminal 10 has information on the final private key.

(4) The first server 20, which is a registration certification authority, cannot know the public key value of the final public key certificate at all.

(5) The second server 30, which is a higher level certification authority, cannot distinguish between the user terminals 10 that have requested for each of the plurality of certificates requested from the various user terminals 10. That is, the privacy of the user terminal 10 is guaranteed.

As described above, according to the plurality of certificate issuing system 100 and the issuing method using the extension function of the present invention, the identification information of the user terminal 10 as the certificate requester is obtained from the second server 30 as the upper level certification authority. Instead, it can be seen that the information of the final private key can be known only to the certificate requester, thereby enhancing the protection of personal information.

Claims (30)

1. In the certificate issuing system,

   Including; a first server;

   The first server,

   Identification information of the user terminal from the user terminal, a value aG obtained by multiplying a random number a by a base point G on an elliptic curve equation, a value pG obtained by multiplying a random number p by the base point G, a first symmetric key, a second symmetric key, and a second symmetric key. Receive 1 index information, second index information, and N value, which is information on the number of certificates,

   A first extension function for inputting the first symmetric key, the first index information, the second index information, and an N value, which is information on the number of certificates; And the aG value; to generate N 2-1 keys,

   A second extension function for inputting the second symmetric key, the first index information, the second index information, and an N value, which is information on the number of certificates; And generating N 2-2 keys using the pG value.
2. The method of claim 1,

   The first expansion function,

   The residual value obtained by dividing the first first internal function value by the order value of the elliptic curve equation is calculated as the first first expansion function value,

   The first first internal function value,

   The first symmetric key and the value obtained by adding 1 to 3 to the first information value are encrypted by a first encryption function, respectively, and then the value obtained by adding 1 to 3 to the first information value and X-OR operation respectively And is the value output by connecting the result of the X-OR operation,

   The first first information value,

   A certificate issuing system, characterized in that it is a value calculated by using the first index information and the second index information.
3. The method of claim 2,

   The first expansion function,

   The residual value obtained by dividing the w-th first internal function value by the order value of the elliptic curve equation is calculated as the w-th first expansion function value,

   The w-th first internal function value,

   After each of the values obtained by adding 1 to 3 to the w-th first information value calculated using the first symmetric key and the w-th first information value is encrypted by the first encryption function, the w-th first information It is the value obtained by adding 1 to 3 to the value and X-OR operation, and the result of X-OR operation is connected and output.

   The w is,

   A certificate issuing system, characterized in that it is a natural number of 2 or more and N or less.
4. The method of claim 3,

   Encryption by the first encryption function,

   (S100) calculating a corresponding k-th round key (R _{k) by using the S value;} And

   (S200) generating an encrypted output using the corresponding k-th round key (R _{k) and T value calculated in step S100; including,}

   The S value is,

   Is the first symmetric key value,

   The T value is,

   One of a first first information value to an N-th first information value; and

   One of 1 to 3; Certificate issuing system, characterized in that the sum of.
5. The method of claim 4,

   The step S100,

   (S110) Separate S into 32-bit word units S _b0 , S _b0+1 , S _b0+2 and S _b0+3 , and S _b0 , S _b0+1 , S _b0+2 and S _b0+3 respectively And preset values F _b0 , F _b0+1 , F _b0+2 and F _b0+3 are calculated respectively, and the initial four keys U _b0 , U _b0+1 , U _b0+2 and U _b0+3 are output. step;

   (S120) sequentially performing X-OR operations of _{U k+1} , U _k+2 and U _k+3 and the constant V _k;

   (S130) converting the result of step S120 by a nonlinear function;

   (S140) converting the result of step S130 by a linear function; And

   (S150) _{calculating U k+4} by performing an X-OR operation on the results of _{U k} and S140 steps; including,

   While increasing k by 1 from b0 to (b0+31), steps S120 to S150 are repeatedly performed,

   The U _k+4 of step S150 is calculated as the k-th round key (R _{k ),}

   The b0 is a certificate issuing system, characterized in that a preset integer.
6. The method of claim 4,

   The step S200,

   (S210) separating T into 32-bit word units T _d0 , T _d0+1 , T _d0+2 and T _d0+3;

   (S220) T _k+1 , T _k+2 and T _k+3 and the k-th round key (R _k ) being continuously X-ORed;

   (S230) converting the result of step S220 by a nonlinear function;

   (S240) converting the result of step S230 by a linear function; And

   (S250) _{calculating T k+4} by performing an X-OR operation on _{T k} and the result of step S240; including,

   While increasing k from d0 to (d0+31) by 1, steps S220 to S250 are repeatedly performed,

   Finally, (T _d0+31+4 , T _d0+31+3 , T _d0+31+2 , T _d0+31+1 ) is output,

   The d0 is a certificate issuing system, characterized in that a preset integer.
7. The method of claim 3,

   Each of the N number 2-1 keys,

   A value obtained by multiplying the base point G by each of the first to the Nth first expansion function values; and

   The aG value; is a certificate issuing system, characterized in that the sum of.
8. The method of claim 3,

   Each of the N 2-2 keys,

   A value obtained by multiplying the base point G by each of the first to the Nth second expansion function values; and

   The certificate issuing system, characterized in that the sum of the pG value;
9. The method of claim 1,

   The first server,

   And transmitting the N keys 2-1 and 2-2 keys to a second server.
10. The method of claim 9,

    The first server,

    Encrypted N certificates and a random number c value are received from the second server,

    Each of the N certificates,

    A certificate issuing system comprising one final public key to be used in the user terminal.
11. The method of claim 10,

    The first server,

    A certificate issuing system, characterized in that transmitting N encrypted certificates and a random number c value to the user terminal.
12. The method of claim 11,

    The certificate issuing system,

    The user terminal; further includes,

    The user terminal,

    Using the random number p and the second expansion function, N inverse encryption function values are calculated,

    A certificate issuing system comprising calculating N final public keys and the random number c value by inverse encryption of the encrypted N certificates and the random number c value using the N inverse encryption function values. .
13. The method of claim 12,

    The user terminal,

    And calculating N final private keys using the random number a, the first extension function, and the random number c.
14. The method of claim 9,

    The certificate issuing system,

    The second server; but further includes,

    The second server,

    The base point G is multiplied by a random number c, and the N number of 2-1 keys are each added to calculate N number of third keys,

    The certificate issuing system, characterized in that the N third keys are N final public keys to be used in the user terminal.
15. The method of claim 14,

    The second server,

    Encrypting the z-th third key and the random number c using the z-th 2-2 key,

    z is,

    A certificate issuing system, characterized in that it is a natural number of 1 or more and N or less.
16. In the method of issuing a certificate,

    The first server, the identification information of the user terminal from the user terminal, a value aG obtained by multiplying a random number a by a base point G on an elliptic curve equation, a value pG obtained by multiplying a random number p and the base point G 2 receiving a symmetric key, first index information, second index information, and a value of N, which is information on the number of certificates;

    A first extension function in which the first server inputs the first symmetric key, the first index information, the second index information, and an N value, which is information on the number of certificates; And generating N 2-1 keys using the aG value; And

    A second extension function in which the first server inputs the second symmetric key, the first index information, the second index information, and an N value, which is the number of certificates; And generating N 2-2 keys using the pG value.
17. The method of claim 16,

    The first expansion function,

    The residual value obtained by dividing the first first internal function value by the order value of the elliptic curve equation is calculated as the first first expansion function value,

    The first first internal function value,

    The first symmetric key and the value obtained by adding 1 to 3 to the first information value are encrypted by a first encryption function, respectively, and then the value obtained by adding 1 to 3 to the first information value and X-OR operation respectively And is the value output by connecting the result of the X-OR operation,

    The first first information value,

    A method of issuing a certificate, characterized in that it is a value calculated by using the first index information and the second index information.
18. The method of claim 17,

    The first expansion function,

    The residual value obtained by dividing the w-th first internal function value by the order value of the elliptic curve equation is calculated as the w-th first expansion function value,

    The w-th first internal function value,

    After each of the values obtained by adding 1 to 3 to the w-th first information value calculated using the first symmetric key and the w-th first information value is encrypted by the first encryption function, the w-th first information It is the value obtained by adding 1 to 3 to the value and X-OR operation, and the result of X-OR operation is connected and output.

    The w is,

    A method of issuing a certificate, characterized in that it is a natural number of 2 or more and N or less.
19. The method of claim 18,

    Encryption by the first encryption function,

    (S100) calculating a corresponding k-th round key (R _{k) by using the S value;} And

    (S200) generating an encrypted output using the corresponding k-th round key (R _{k) and T value calculated in step S100; including,}

    The S value is,

    Is the first symmetric key value,

    The T value is,

    One of a first first information value to an N-th first information value; and

    One of 1 to 3; Certificate issuing method, characterized in that the sum of.
20. The method of claim 19,

    The step S100,

    (S110) Separate S into 32-bit word units S _b0 , S _b0+1 , S _b0+2 and S _b0+3 , and S _b0 , S _b0+1 , S _b0+2 and S _b0+3 respectively And preset values F _b0 , F _b0+1 , F _b0+2 and F _b0+3 are calculated respectively, and the initial four keys U _b0 , U _b0+1 , U _b0+2 and U _b0+3 are output. step;

    (S120) sequentially performing X-OR operations of _{U k+1} , U _k+2 and U _k+3 and the constant V _k;

    (S130) converting the result of step S120 by a nonlinear function;

    (S140) converting the result of step S130 by a linear function; And

    (S150) _{calculating U k+4} by performing an X-OR operation on the results of _{U k} and S140 steps; including,

    While increasing k by 1 from b0 to (b0+31), steps S120 to S150 are repeatedly performed,

    The U _k+4 of step S150 is calculated as the k-th round key (R _{k ),}

    The b0 is a certificate issuing method, characterized in that a preset integer.
21. The method of claim 19,

    The step S200,

    (S210) separating T into 32-bit word units T _d0 , T _d0+1 , T _d0+2 and T _d0+3;

    (S220) T _k+1 , T _k+2 and T _k+3 and the k-th round key (R _k ) being continuously X-ORed;

    (S230) converting the result of step S220 by a nonlinear function;

    (S240) converting the result of step S230 by a linear function; And

    (S250) _{calculating T k+4} by performing an X-OR operation on _{T k} and the result of step S240; including,

    While increasing k from d0 to (d0+31) by 1, steps S220 to S250 are repeatedly performed,

    Finally, (T _d0+31+4 , T _d0+31+3 , T _d0+31+2 , T _d0+31+1 ) is output,

    The d0 is a method of issuing a certificate, characterized in that a preset integer.
22. The method of claim 18,

    Each of the N number 2-1 keys,

    A value obtained by multiplying the base point G by each of a first first expansion function value to an Nth first expansion function value; and

    The aG value; is a certificate issuing method, characterized in that the sum of.
23. The method of claim 18,

    Each of the N 2-2 keys,

    A value obtained by multiplying the base point G by each of the eleventh second expansion function values to the Nth second expansion function values; and

    The method of issuing a certificate, characterized in that the sum of the pG value;
24. The method of claim 16,

    The above certificate issuance method,

    And transmitting, by the first server, the N 2-1 keys and the N 2-2 keys to a second server.
25. The method of claim 24,

    The above certificate issuance method,

    Receiving, by the first server, the encrypted N certificates and a random number c value from the second server; further comprising,

    Each of the N certificates,

    A method of issuing a certificate, characterized in that it contains one final public key to be used in the user terminal.
26. The method of claim 25,

    The above certificate issuance method,

    And transmitting, by the first server, the encrypted N certificates and the random number c value to the user terminal.
27. The method of claim 26,

    The above certificate issuance method,

    Calculating, by the user terminal, N inverse encryption function values using the random number p and the second expansion function; And

    Calculating, by the user terminal, N final public keys and random number c values by inverse encryption of the N encrypted certificates and the random number c value using the N inverse encryption function values; Certificate issuing method further comprising a.
28. The method of claim 27,

    The above certificate issuance method,

    The user terminal further comprises: calculating N final private keys using the random number a, the first expansion function, and the random number c.
29. The method of claim 24,

    The above certificate issuance method,

    The second server, the base point G multiplied by a random number c, each adding the N number of 2-1 keys, calculating N number of third keys; further comprising,

    The method of issuing a certificate, wherein the N third keys are N final public keys to be used in the user terminal.
30. The method of claim 29,

    The above certificate issuance method,

    The second server encrypting the z-th third key and the random number c by using the z-th 2-2 key; further comprising,

    z is,

    A method of issuing a certificate, characterized in that it is a natural number equal to or greater than 1 and equal to or less than N.

Images